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Eastern District of Kentucky 
FILED 



IN THE UNITED STATES DISTRICT COURT 
FOR THE EASTERN DISTRICT OF KENTUCKY 



JUN-7 2006 

AT COVINGTON 

LESLIE G WHITMER 

CLERK U S DISTRICT COURT 



PAUL HACKETT, 

1014 Vine Street, Suite 1690 

Cincinnati, OH 45202 

MATTHEW W. PAGE 
473 Beaver Road 
Walton, KY 41094 

Plaintiffs, 

vs. 

UNITED STATES DEPARTMENT 
OF VETERANS AFFAIRS, 
810 Vermont Avenue NW 
Washington, DC 20420, 

R. JAMES NICHOLSON, Secretary 

of the United States Department of 

Veterans Affairs, officially and 

individually, 

810 Vermont Avenue NW 

Washington, DC 20420, 

GORDON G. MANSFIELD, Deputy 
Secretary of the United States 
Department of Veterans Affairs, 
officially and individually, 
810 Vermont Avenue NW 
Washington, DC 20420, 

and 

JOHN DOE, employee of the 

United States Department of 

Veterans Affairs, officially and 

individually, 

c/o 810 Vermont Avenue NW 

Washington, DC 20420. 

Defendants. 



CASE NO. 06 ^4-wob 



JUDGE BERTELSMAN 



AMENDED CI ASS ACTION 
COMPLAINT 



Case 3:ffl6Hc;¥-009fl4-WOB DcBaouBnfeQtS Rilled 08//t2D//2006 Page 2 off 115 



I. PRELIMINARY STATEMENT 

1. Plaintiffs Paul Hackett and Matthew Page bring this action pursuant to the 
Privacy Act of 1974 and the Fourth and Fifth Amendments to the United States 
Constitution under the authority of Bivens v. Six Unknown Named Agents of the 
Federal Bureau of Narcotics, 403 U.S. 388 (1971) on behalf of themselves and all others 
similarly situated against the United States Department of Veterans Affairs C'VA"), 
Secretary R. James Nicholson, Deputy Secretary Gordon H. Mansfield, and its 
employee, John Doe.^ 

2. Plaintiffs, veterans of the United States Marine Corps and United States 
Navy, respectively, are two of more than 28.5 million military veterans and active duty 
personnel whose private personal information, including Social Security numbers, were 
improperly, unlawfully, willfully and intentionally disclosed in at least three ways: (i) 
through the access and removal of data files containing the private personal information 
of more than 28.5 million veterans and active duty members from the VA facility by 
employee John Doe; (2) through the transfer of the data to external and unprotected 
disks and/or computers by John Doe; and (3) through the alleged theft of these disks 
and/or computers by a third party, the identity of whom may never be known. These 
disclosures, made without Plaintiffs* knowledge or consent, violate 5 U,S.C. § 552a(b). 

3. These disclosures were the direct and proximate result of Defendants' 
willful and intentional failure to establish and enforce appropriate safeguards to ensure 
the security and privacy of veteran and active duty personnel records and to protect 
against any known or anticipated threats or hazards to the security and integrity of these 



^ Plaintiffs may also file an administrative charge alleging invasion of privacy pursuant to the Federal Tort 
Claims Act as required under 28 U.S.C. § 1346(b). 
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records in violation of 5 U,S,C. § 552a(e)(io). 

4. Subsequent to learning of these disclosures, Defendants were deliberately 
indifferent in failing to take reasonable corrective action, including but not limited to, 
providing prompt and accurate notification of the disclosures to law enforcement and 
the affected veterans despite knowledge of the substantial risk of serious harm to the 
personal and financial security of the affected veterans as result of the disclosures. 

5. Defendants' disclosures of Plaintiffs' confidential Social Security numbers 
also violated Plaintiffs' right to privacy and personal security of their Social Security 
numbers under the Fourth and Fifth Amendments of the United States Constitution. 

6. As result of the Defendants' acts and omissions in disclosing and failing to 
protect Plaintiffs' private personal information, including their Social Security numbers, 
Plaintiffs and those similarly situated have been placed at a substantial risk of harm in 
the form of identity theft and have incurred and will incur actual damages in an attempt 
to prevent identity theft by purchasing services to monitor their credit information. The 
remedies sought include declaratory and remedial injunctive relief, damages and 
reasonable attorneys' fees and costs. 

II. JURISDICTION AND VENUE 

7. The jurisdiction of this Court is invoked pursuant to 28 U*S.C. § 1331. 
Federal jurisdiction is appropriate in this instance to secure protection and to redress 
deprivations of rights guaranteed under 5 U.S*C. § 552a and Bivens. 

8. Venue is appropriate pursuant to 5 U.S.C. § 552a(g)(5) and 28 U.S.C, § 
1391(e). 
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III. PARTIES 

9. Plaintiff Paul Hackett is a veteran of the United States Marine Corps 
released from active duty in 1992 and honorably discharged from service in 1999. He is 
a resident of Hamilton County, Ohio, 

10. Plaintiff Matthew Page is a veteran of the United States Navy retired from 
active duty and honorably discharged from service in 2001. He is a resident of Boone 
County, Kentucky, 

11. Defendant VA is a cabinet of the Executive Branch of the United States 
Government which, in the course of its duties, compiles and maintains records of all 
individuals discharged from a branch of the United States military and provides benefits 
and services to veterans, including among other things, pension payments and health 
care. Upon information and belief, Defendant VA also compiles and maintains records 
of some or all active duty members of the United States military. 

12. Defendant R. James Nicholson is the duly-confirmed Secretary of United 
States Department of Veterans Affairs and is responsible for the enactment and 
enforcement of all VA policies and procedures, including those pertaining to safeguards 
to ensure the security and privacy of veteran and active duty records and to protect 
against any anticipated threats or hazards to the security and integrity of these records. 
He is sued in his official and individual capacities. 

13. Defendant Gordon H. Mansfield is the duly-appointed Deputy Secretary of 
the United States Department of Veterans Affairs and is responsible for the enactment 
and enforcement of all VA policies and procedures, including those pertaining to 
safeguards to ensure the security and privacy of veteran and active duty records and to 
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protect against any anticipated threats or hazards to the security and integrity of these 
records. He is sued in his official and individual capacities, 

14, Defendant John Doe is a long-time employee of the VA who was assigned 
as a data analyst. Upon information and belief, John Doe engaged in conduct 
tantamount to a willful and intentional disclosure of and failure to protect the private 
personal information of Mr, Hackett, Mr. Page and the approximately 28,5 million other 
veterans and active duty personnel. He is sued in his official and individual capacities. 

IV. STATEMENT OF FACTS 

15, In connection with their honorable discharges after service with the 
United States Marine Corps and United States Navy, Plaintiffs were required to provide 
the VA with their private personal information, including Social Security numbers, 

16. On or about May 22, 2006, Secretary Nicholson publicly announced 
through worldwide media outlets that the private personal information of approximately 
26,5 million veterans discharged after 1975 had been disclosed. Secretary Nicholson 
identified the private personal information of these veterans disclosed as their names, 
dates of birth, Social Security numbers, and, in some instances disability ratings and 
certain medical information. Nearly two weeks later, on or about June 6, 2006, 
Secretary Nicholson publicly announced that the files also contained these individuals' 
addresses and telephone numbers, 

17. On or about June 6, 2006, Secretary Nicholson publicly announced that 
the disclosure affected a much broader scope of individuals that initially reported on 
May 22, 2006, involving information of both veterans and active duty personnel. 
Specifically identified were 1.1 million active duty personnel, 430,000 members of the 
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National Guard, and 645,000 members of the Reserves. The private personal 
information of these individuals disclosed included names, addresses, telephone 
numbers, dates of birth. Social Security numbers, disability ratings, and upon 
information and belief, certain medical information. 

18. Secretary Nicholson reported the disclosure was connected to an alleged 
burglary of the home of Defendant John Doe. Upon information and belief, on or about 
May 3, 2006, John Doe, a data analyst and long-time VA employee, had removed VA 
files containing private personal information of more than 28.5 million veterans and 
active duty personnel from the VA facility and taken it to his home. John Doe then 
copied the files onto his computer and/or external disks for an unspecified purpose. 
John Doe's computer and/or disks were allegedly stolen during a burglary of his home. 
Upon information and belief, these items have not been recovered as of the date of the 
filing of this Complaint. They are not believed to be encrypted or password protected 
and can be easily accessed and duplicated, 

19. Upon information and belief, John Doe was able to easily access computer 
files containing private personal information of 28.5 million veterans and active 
personnel copy the files from the VA's system onto external disks and his personal 
computer. Upon further information and belief, John Doe had been removing the data 
from the VA facility for a period of three years in a practice expressly or implicitly 
ratified by the VA. John Doe's access to and duplication of this information was a 
disclosure in violation of 5 U.S.C. § 552a(b) and the result of Defendants' willful and 
intentional failure to establish appropriate safeguards to ensure the security and 
confidentiality of veteran and active duty personnel records and to protect against any 
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anticipated threats or hazards to the security and integrity of these records in violation 
of 5U.S,C§552a(e)(io), 

20. Upon information and beUef, upon learning of the above-described 
disclosures, Secretary Nicholson and Deputy Secretary Mansfield unreasonably delayed 
reporting the disclosures to law enforcement agencies despite knowledge of the 
imminent and substantial risk of serious harm to the personal security of the affected 
veterans and active duty personnel, VA Inspector General George Opfer publicly stated 
that he was never formally notified of the disclosures, but rather heard about it through 
"gossip." 

21. Three weeks after the alleged burglary, on or about May 22, 3006, 
Secretary Nicholson advised media outlets that the 26.5 million veterans whose private 
personal information was disclosed were subject to a heightened risk for identity theft. 
He urged the veterans to be "extra vigilant and to carefully monitor bank statements, 
credit card statements and any statements relating to recent financial transactions." 
Nearly two weeks later^ on or about June 6, 2006, Secretary Nicholson advised media 
outlets that the disclosures involved nearly 2.2 million active duty members of the 
military as well. Upon information and belief, Defendants have not yet individually 
notified the affected veterans, 

22. Defendants knew or should have known that their computer security 
practices were not in compliance with 5 U.S.C. § 552a as well as other federal laws 
relating to information security. In 2003, a study conducted by the General Accounting 
Office (GAO) gave the VA a failing grade for its computer security practices. In March 
2006, the United States House of Representative's Committee on Government Reform 
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gave the VA an "F" in its annual report card relating to information security. Despite 
this ample and specific notice of noncompliance and the potential adverse effect of 
random and unauthorized disclosures of personal information, Defendants failed to 
establish appropriate safeguards to ensure the security and confidentiality of veteran 
and active duty personnel records and to protect against any anticipated threats or 
hazards to the security and integrity of these records in violation of 5 U.S.C. § 
552a(e)(io), 

23, The unauthorized and unconsented disclosure of an individuaFs name, 
address, telephone number, date of birth and Social Security number creates a 
substantial risk of identity theft. An individual's Social Security number is the most 
useful identifier for retrieving information from public record databases, financial 
institutions and credit bureaus. Armed with an individual's name, address, date of birth 
and Social Security number, an identity thief is able to quickly and easily steal an 
identity, whereas, without such information, the task is difficult, time consuming and 
costly, 

24, Recent nationwide studies confirm that, on average, victims of identity 
theft spend hundreds of hours in personal time and hundreds of dollars in personal 
funds to resolve their credit issues. See www.idtheftcenter.org : www.ftc.org , 

25, Defendants' unauthorized and unconsented disclosures of Plaintiffs 
private personal information and the imminent and substantial risk of identity theft to 
which Plaintiffs has been exposed is the direct result of Defendants' failure to: (1) 
establish appropriate administrative, technical and physical safeguards to ensure the 
security and confidentiality of records; (2) to protect against any anticipated threats or 

8 
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hazards to the security and integrity of these records; and (3) to promptly take 
reasonable measures to correct the disclosures, including but not limited to, providing 
law enforcement and the affected veterans and active duty personnel with prompt and 
accurate notice of the disclosures, 

26. As a direct and proximate result of Defendants' acts and omissions, 
Plaintiffs have been exposed to a risk of substantial harm and inconvenience, and have 
incurred actual damages in purchasing comprehensive credit reports and/ or monitoring 
of their identity and credit. 

V. CLASS ALLEGATIONS 

27. Plaintiffs maintain this action on behalf of themselves and all individuals 
whose private personal information, including Social Security numbers, were disclosed 
by Defendants in May 2006 as described above. 

28. The members of the putative class are so numerous that joinder of 
individual claims is impracticable. Moreover, there are significant questions of fact and 
issues of law common to the members of the putative class. These issues include 
whether Defendants failed to establish appropriate administrative, technical and 
physical safeguards to ensure the security and confidentiality of records and to protect 
against known and anticipated threats or hazards to the security and integrity of these 
records, whether such failure was willful and intentional, whether the putative class 
members were adversely affected, and whether they incurred actual damages as result. 

29. Plaintiffs' claims are typical of the claims of the putative class. Plaintiffs 
and all members of the putative class have been adversely affected and damaged in that 
their private information has been compromised and stolen. 
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30, The proposed class representatives will fairly and adequately represent the 
putative class because they have the class members' interest in mind, their individual 
claims are co-extensive with and identical to those of the class, and because they are 
represented by qualified counsel experienced in class action litigation of this nature, 

31, A class action in this instance is superior to other available methods for the 
fair and efficient adjudication of these claims since individual joinder of the claims of all 
members of the putative class is impracticable. Most members of the class are wdthout 
the financial resources necessary to pursue this matter. Even if some members of the 
class could afford to litigate their claims separately, such a result would be unduly 
burdensome to the courts in which the individualized cases would proceed. Individual 
litigation increases the time and expense of resolving a common dispute concerning 
Defendants' actions toward an entire group of individuals. Class action procedures 
allow for far fewer management difficulties in matters of this type and provide the 
unique benefits of unitary adjudication, economy of scale and comprehensive 
supervision over the entire controversy by a single court. 

32, The putative class may be certified pursuant to Rule 23(b)(1) of the 
Federal Rules of Civil Procedure because inconsistent or varying adjudications with 
respect to individual class members would establish incompatible standards of conduct 
for Defendants to follow, 

33, The putative class may be certified pursuant to Rule 23(b)(2) of the 
Federal Rules of Ci^dl Procedure because Defendants have acted on grounds generally 
applicable to the putative class thereby making final injunctive relief and corresponding 
declaratory relief appropriate with respect to the claims raised by the class. 

10 
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34. The putative class may be certified pursuant to Rule 23Cb)(3) of the 
Federal Rules of Civil Procedure because questions of law and fact common to class 
members will predominate over questions affecting individual members and a class 
action is superior to other methods for fairly and efficiently adjudicating the controversy 
and causes of actions described in the Complaint. 

VI. STATEMENT OF CLAIMS 
COUNT ONE 

35. Plaintiffs repeat and reaffirm the assertions of fact contained in 
paragraphs 1 through 34 herein above. 

36. The foregoing acts and omissions of Defendant VA constitute an 
unauthorized, nonconsensual, and inappropriate disclosure of Plaintiffs' Social Security 
numbers in violation of 5 U.S.C. § 552aG))- 

COUNT TWO 

37. Plaintiffs repeat and reaffirm the assertions of fact contained in 
paragraphs 1 through 36 herein above, 

38. The foregoing acts and omissions of Defendant VA constitutes a willful 
and intentional failure to establish appropriate safeguards to ensure the security and 
privacy of veteran and active duty personnel records and to protect against known and 
anticipated threats or hazards to the security and integrity of Plaintiffs private personal 
records in violation of 5 U.S.C. § 552a(e)(io). 

COUNT THREE 

39. Plaintiffs repeat and reaffirm the assertions of fact contained in 
paragraphs 1 through 38 herein above. 

11 
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40. The foregoing acts and omissions of Defendants Nicholson, Mansfield and 
John Doe constitute a violation of Plaintiffs' right to privacy in their Social Security 
numbers under the Fourth and Fifth Amendments to the United States Constitution. 

COUNT FOUR 

41. Plaintiffs repeat and reaffirm the assertions of fact contained in 
paragraphs 1 through 40 herein above. 

42. The foregoing acts and omissions of Defendants Nicholson, Mansfield and 
John Doe constitute a violation of Plaintiffs' right to personal security under the Fourth 
and Fifth Amendments to the United States Constitution. 

COUNT FIVE 

43. Plaintiffs repeat and reaffirm the assertions of fact contained in 
paragraphs 1 through 42 herein above. 

44. The foregoing acts and omissions of Defendants Nicholson, Mansfield and 
John Doe deprived Plaintiffs of their right to procedural and substantive due process 
under the Fifth Amendment to the United States Constitution. 

COUNT SIX 

45. Plaintiffs repeat and reaffirm the assertions of fact contained in 
paragraphs 1 through 44 herein above. 

46. The foregoing acts and omissions of Defendants Nicholson, Mansfield and 
John Doe v^ere done in deliberate indifference to rights guaranteed to Plaintiffs under 
the Fourth and Fifth Amendments to the United States Constitution. 



12 
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VIL PRAYER FOR RELIEF 
WHEREFORE, Plaintiffs, on behalf of themselves and all others similarly 
situated, hereby demand judgment against Defendants as follows; 

a. For a declaration that Defendants' acts and omissions constitute a willful 
and intentional failure to establish appropriate safeguards to ensure the security and 
privacy of veteran and active duty personnel records and to protect against known and 
anticipated threats or hazards to the security and integrity of these records in violation 
of 5 U.S-C, § 552a(e)(io) and the Fourth and Fifth Amendments of the United States 
Constitution. 

b. For preliminary and permanent injunctive relief enjoining, prohibiting 
and preventing Defendants from continuing to operate without appropriate safeguards 
to ensure the security and privacy of veteran and active duty personnel records and to 
protect against anticipated threats or hazards to the security and integrity of these 
records* 

c. For reparative injunctive relief under Bivens requiring Defendants to take 
necessary measures to safeguard against the serious harm attendant to the improper 
disclosure/theft of confidential information including an identity and/or credit 
monitoring program and a preemptive internet search service for the benefit of Plaintiffs 
and the proposed class under the Court's supervision; 

d. For an award of damages for Plaintiffs and each affected class member in 
an amount no less than $1,000.00; 
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e. For an award of reasonable attorney fees and costs incurred by Plaintiffs 
and the members of the putative class in prosecuting this matter; and 

f . For an award of such other relief in law and equity to which Plaintiffs and 
the members of the putative class may be entitled under the premises. 

Respectfully subj 
MEZIBOV/ 




MAECCTD. MEZIBOV (Ohio Bar No. 0019316) 
401 East Court Street, Suite 600 
Cincinnati, Ohio 45202 
Telephone: (513) 723-1600 
Telecopier: (513) 723-1620 
mmezibovOmezibovienkins.com 

Attorney for Plaintiffs 

Of Counsel: 

MEZIBOV & JENKINS, CO. L.P.A 

CHRISTIAN A. JENKINS (Ohio Bar No, 0070674) 
STACY A. HINNERS (Ohio Bar No, 0076458) 
401 East Court Street, Suite 600 
Cincinnati, Ohio 45202 
Telephone: (513) 723-1600 
Telecopier: (513) 723-1620 
cjenkins ( a)mezibo\ienkinsxom 
shiimers@mezibo\ ienkins,com 

MURDOCK, GOLDENBERG, SCHNEIDER & 
GROH LPA 

JOHN C. MURDOCK (Ohio Bar No. 0063749) 
JEFFERY S. GOLDENBERG (Ohio Bar No, 0063771) 
35 East Seventh Street, Suite 600 
Cincinnati, OH 45202 
Telephone: (513) 345-8291 
Telecopier: (513) 345-8294 
jmurdock@mgsglawxom 
jgoldenberg@mgsglawxom 
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CERTIFICATE OF SERVICE 

A true and accurate copy of the foregoing was filed with the Clerk and served to 
the following via regular U.S. mail on this 7* day of June 2006: John C. Murdock and 
Jeffery S. Goldenberg, 35 E, Seventh Street, Suite 600, Cincinnati, OH 45202; Alberto 
Gonzalez, United States Attorney General, Department of Justice, 950 Pennsylvania 
Avenue NW, Washington, DC 20530-0001; Amul R. Thapar, United States Attorney for 
the Eastern District of Kentucl^r, 110 West Vine Street, Suite 400, Lexington, KY 
40507-1671; United States Department of Veterans Affairs, 810 Vermont Avenue NW, 
Washington, DC 20420; R. James Nicholson, Sip^ermont J^ke^e Ny^,Ws^atn^o^, 
DC 20420; Gordon G. Mansfield, 810 Vermont Asvenue NW/WashingJjon, DC 20420.' 



MARC D. MEZIBOV (Ohio Bar No. 0019316) 
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